CVE-2026-28427 Details
Description
OpenDeck is Linux software for your Elgato Stream Deck. Prior to 2.8.1, the service listening on port 57118 serves static files for installed plugins but does not properly sanitize path components. By including ../ sequences in the request path, an attacker can traverse outside the intended directory and read any file OpenDeck can access. This vulnerability is fixed in 2.8.1.
A path traversal vulnerability has been identified in OpenDeck, a Linux application for Elgato Stream Deck, in versions prior to 2.8.1. The vulnerability arises because the web server component, which listens on port 57118, fails to properly sanitize file path requests for installed plugins. This lack of validation allows attackers to manipulate the request path to traverse outside the intended directory and access any file that OpenDeck can read. Exploitation of this vulnerability could lead to the disclosure of sensitive user information, such as SSH keys or application credentials.
Users are advised to update OpenDeck to version 2.8.1 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
| CWE-24 | Path Traversal: '../filedir' | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| nekename opendeck | < 2.8.1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 21, 2026 | Initial Analysis | [email protected] |
| Mar 4, 2026 | New CVE Received | [email protected] |